为浏览器内 ajax 客户端缓存凭据的安全方法是什么？
- 用户通过浏览器输入丰富的网络应用程序
- 用户输入登录凭据。凭证被编码和缓存。 （这些凭证用于浏览器内的 REST 客户端，该客户端将使用 xhr 与服务器交互。）
- 用户执行各种任务/更新，每个任务/更新都会发出一个 ajax 请求，传递编码的凭证（通过 https 进行基本身份验证）。
- 用户单击一个链接，将他带到另一个资源（发生整个页面重新加载，而不是较小的 ajax 请求）。
由于整个应用程序使用内部 REST 客户端，因此每个请求都必须传递凭据。当用户第一次访问该网站时，我可以毫无问题地提示用户输入这些凭据。问题是存储编码的用户名/密码哈希最安全的方法是什么？如果这是一个单页网络应用程序，我想它可以安全地缓存在内存中。但是，由于用户有时会转移到其他资源（步骤 4），我希望允许他继续工作而无需再次进行身份验证。这必须涉及将他的凭据缓存在某个地方（在 cookie 或 localStorage 中？）。无论如何，我需要访问他已经提供的凭据，以便客户端即使在整个页面重新加载后也可以继续在每个请求中传递它们。
我关心以安全的方式做到这一点。有这方面的最佳实践吗？
- User enters rich web app via his browser
- User enters login credentials. Credentials are encoded and cached. (The credentials are for an in-browser REST client that will use xhr to interact with the server.)
- User performs various tasks/updates, each of which makes an ajax request passing along the encoded credentials (basic authentication via https).
- User clicks on a link which takes him to another resource (a full page reload occurs rather than a smaller ajax request).
Since the entire application uses an internal REST client, each request has to pass along credentials. I have no problem prompting the user for those credentials when he first accesses the site. The question is what’s the safest way to store his encoded username/password hash? If this was a single-page web app, I guess this could be safely cached in memory. However, as the user sometimes moves to other resources (step 4), I would like to allow him to continue working without having to authenticate again. This must involve caching his credentials somewhere (in a cookie or localStorage?). Anyway, I need to access his already provided credentials so that the client can continue passing them along on every request even after a full page reload.
I am concerned with doing this in a secure manner. Are there best practices for this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我认为 LocalStorage 或 cookie 都是存储您的凭据的好地方...个人偏好是 LocalStorage。我使用几个基于 OAuth 的 Web 应用程序来执行此操作。
您可以选择加密/解密进出您最终选择的任何信息：
https:// stackoverflow.com/questions/2299434/bcrypt-implementation-in-javascript
顺便说一句，您可能需要研究 OAuth，因为规范中为您的具体用例定义了一个工作流程。
I think either LocalStorage or cookies would be a fine place to store your credentials... personal preference would be LocalStorage. I do this with a couple OAuth based web applications.
You could choose to encrypt/decrypt the information going in and out of whatever you end up choosing:
https://stackoverflow.com/questions/2299434/bcrypt-implementation-in-javascript
As an aside, you may want to look into OAuth as there is a workflow defined in the specification for your exact use case.